[Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .

Waines, Greg Greg.Waines at windriver.com
Mon Jul 4 12:30:16 UTC 2022


Hey Chandan,

Thanks for bringing this up.

I chatted with Scott about this.

Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot.  Although the StarlingX build infrastructure allows it to be added.
Neither of these points are properly documented in docs.starlingx.io   ☹

I can’t remember the details of why we are not doing this.
I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key.

Can you raise a starlingx launchpad ( https://launchpad.net/starlingx ) to address the docs.starlingx.io documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ?

Greg.


From: Scott Little <scott.little at windriver.com>
Sent: Wednesday, June 29, 2022 10:42 AM
To: starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .

On 2022-06-02 13:12, Kumar, Chandan wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi,

I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”.

However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso.
I believe, the public key provided with iso is not correct. Can you please confirm ?

Regards,
Chandan Kumar.



_______________________________________________

Starlingx-discuss mailing list

Starlingx-discuss at lists.starlingx.io<mailto:Starlingx-discuss at lists.starlingx.io>

http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__http:/lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss__;!!AjveYdw8EvQ!e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg$>

Thanks for the report.   I'll look into it

Scott Little


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20220704/eebb3203/attachment.htm>


More information about the Starlingx-discuss mailing list